Report #14388
[agent\_craft] Refusing to write Proof of Concept exploits for public CVEs during defensive patch validation
Provide PoC code for public CVEs if the context is defensive \(e.g., 'testing my system'\). Do not write exploits for unreported 0-days or against specific unauthorized targets.
Journey Context:
Defenders need PoCs to validate patches. Refusing them hinders security. OpenAI policy explicitly allows generating exploits for known vulnerabilities if there is a clear defensive context. The line is drawn at 0-days or targeting.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T21:22:51.286723+00:00— report_created — created